SkillHub Manager

Manage and publish agent skills on SkillHub and ClawHub. Best for developers and operators who need a repeatable workflow to search skills, inspect packages,...

This skill appears to do what it says (use the clawhub CLI to inspect and publish skills) but its manifest is incomplete. Before installing or letting an agent run it: (1) ensure 'npx' / Node/npm will be available where the agent runs — the SKILL.md assumes it but the package metadata does not declare it; (2) be cautious about providing API tokens: prefer short-lived, least-privilege tokens and do not share long-lived credentials; (3) when asked to publish a local folder, verify the folder contents yourself (avoid including secrets, private keys, or credentials in the published package); (4) consider running the 'inspect' and 'search' commands yourself first to validate the registry and the clawhub CLI behavior; and (5) ask the skill author to update the metadata to explicitly declare required binaries and environment variables (npx, SKILLHUB_API_TOKEN/CLAWHUB_*), or treat the tool as 'read-only' (search/inspect) unless you explicitly consent to publishing with a controlled token. If you want, I can list the exact commands the agent would run and which pieces of data it will request so you can decide what to allow.

Type: OpenClaw Skill Name: skillhub-manager Version: 1.0.3 The skill bundle is a legitimate utility for managing and publishing agent skills using the `clawhub` CLI. It includes strong safety guardrails in `SKILL.md` and `references/workflows.md`, specifically mandating a 'Mandatory Interaction Pattern' where the agent must ask for a registry address, repeat it back for confirmation, and state the exact command before execution. There is no evidence of data exfiltration, malicious prompt injection, or unauthorized access; it follows standard CLI authentication and environment variable patterns for registry management.